Systems and methods for steering traffic into SR-TE policies
In one embodiment, a method includes a method includes receiving, by a headend node, network traffic. The method also includes determining, by the headend node, that the network traffic matches a service route. The method further includes steering, by the headend node, the network traffic into an SR-TE policy. The SR-TE policy is associated with the service route and includes a security level constraint.
1. A system, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause one or more network nodes within a network to perform operations comprising:
receiving network traffic;
computing a dynamic candidate path using segment IDs (SIDs) each having a security level equal to or greater than a security level constraint, wherein:
the dynamic candidate path is associated with a segment routing for traffic engineering (SR-TE) policy;
the security level of a first SID of the SIDs is a value representing a level of trustworthiness of the first SID; and
the security level constraint is a value representing a level of trustworthiness;
determining that the network traffic matches a service route associated with the SR-TE policy;
selecting the dynamic candidate path for the SR-TE policy; and
steering the network traffic into the dynamic candidate path for the SR-TE policy.
2. The system of claim 1 , wherein:
the service route and the SR-TE policy are associated with a color;
the color is a numerical value that differentiates multiple SR-TE policies between a pair of network nodes of the network; and
the color indicates one or more requirements for steering the network traffic through the network, wherein the one or more requirements comprise a minimum security level.
3. The system of claim 1 , wherein:
the dynamic candidate path is associated with a plurality of SID lists; and
the security level of the dynamic candidate path is equal to a lowest security level of the SIDs within the plurality of SID lists.
4. The system of claim 3 , the operations further comprising signaling the security level of the dynamic candidate path in a Stateful Path Computation Element Protocol (PCEP).
5. The system of claim 1 , the operations further comprising:
defining the security level constraint for the dynamic candidate path;
pruning all of the SIDs within the network having the security level lower than the value of the security level constraint; and
computing the dynamic candidate path using only the remaining SIDs.
6. The system of claim 1 , wherein the service route is associated with at least one of the following:
a Border Gateway Protocol (BGP); and
a Locator/Identifier Separation Protocol (LISP).
7. The system of claim 1 , wherein:
one or more candidate paths associated with the SR-TE policy are computed by an SR-path computation element (SR-PCE); and
the SR-PCE computes the one or more candidate paths using one or more views received from a view-maker network element.
8. A method, comprising:
receiving network traffic;
computing a dynamic candidate path using segment IDs (SIDs) having a security level equal to or greater than a security level constraint, wherein:
the dynamic candidate path is associated with a segment routing for traffic engineering (SR-TE) policy;
the security level of a first SID of the SIDs is a value representing a level of trustworthiness of the first SID; and
the security level constraint is a value representing a level of trustworthiness;
determining that the network traffic matches a service route associated with the SR-TE policy;
selecting the dynamic candidate path for the SR-TE policy; and
steering the network traffic into the dynamic candidate path for the SR-TE policy.
9. The method of claim 8 , wherein:
the service route and the SR-TE policy are associated with a color;
the color is a numerical value that differentiates multiple SR-TE policies between a pair of network nodes of a network; and
the color indicates one or more requirements for steering the network traffic through the network, wherein the one or more requirements comprise a minimum security level.
10. The method of claim 8 , wherein:
the dynamic candidate path is associated with a plurality of SID lists; and
the security level of the dynamic candidate path is equal to a lowest security level of the SIDs within the plurality of SID lists.
11. The method of claim 10 , further comprising signaling the security level of the dynamic candidate path in a Stateful Path Computation Element Protocol (PCEP).
12. The method of claim 8 , further comprising:
defining the security level constraint for the dynamic candidate path;
pruning all of the SIDs having the security level lower than the value of the security level constraint; and
computing the dynamic candidate path using only the remaining SIDs.
13. The method of claim 8 , wherein the service route is associated with at least one of the following:
a Border Gateway Protocol (BGP); and
a Locator/Identifier Separation Protocol (LISP).
14. The method of claim 8 , wherein:
one or more candidate paths associated with the SR-TE policy are computed by an SR-path computation element (SR-PCE); and
the SR-PCE computes the one or more candidate paths using one or more views received from a view-maker network element.
15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving network traffic;
computing a dynamic candidate path using segment IDs (SIDs) having a security level equal to or greater than a security level constraint, wherein:
the dynamic candidate path is associated with a segment routing for traffic engineering (SR-TE) policy;
the security level of a first SID of the SIDs is a value representing a level of trustworthiness of the first SID; and
the security level constraint is a value representing a level of trustworthiness;
determining that the network traffic matches a service route associated with the SR-TE policy;
selecting the dynamic candidate path for the SR-TE policy; and
steering the network traffic into the dynamic candidate path for the SR-TE policy.
16. The one or more computer-readable non-transitory storage media of claim 15 , wherein:
the service route and the SR-TE policy are associated with a color;
the color is a numerical value that differentiates multiple SR-TE policies between a pair of network nodes of a network; and
the color indicates one or more requirements for steering the network traffic through the network, wherein the one or more requirements comprise a minimum security level.
17. The one or more computer-readable non-transitory storage media of claim 15 , wherein:
the dynamic candidate path is associated with a plurality of SID lists; and
the security level of the dynamic candidate path is equal to a lowest security level of the SIDs within the plurality of SID lists.
18. The one or more computer-readable non-transitory storage media of claim 17 , the operations further comprising signaling the security level of the dynamic candidate path in a Stateful Path Computation Element Protocol (PCEP).
19. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:
defining the security level constraint for the dynamic candidate path;
pruning all of the SIDs having the security level lower than the value of the security level constraint; and
computing the dynamic candidate path using only the remaining SIDs.
20. The one or more computer-readable non-transitory storage media of claim 15 , wherein the service route is associated with at least one of the following:
a Border Gateway Protocol (BGP); and
a Locator/Identifier Separation Protocol (LISP).